Please log in before viewing your order history.';
$to = 'orderHistory';
} elseif (isset($_REQUEST['checkout'])) {
$beforeForm = 'Please log in before placing your order.
';
$to = 'checkout';
}
//$hmacPasswordSecret = 'ts1f5SD4THOuUPo+89f/5XgZwYSs5nt5MIOOu1Csu3x9zP7bEdLuu7VBY8BhCW5XD5Tw4dm9vSlV451eY+mDzFJf02T2UofoZbt/u9Nb9Fy1rOznFqVpg+RuiN76xSSI40mwZGms1YVZQKcQQiVYjMcgDV6IxqH6lUY1rCs9w5o=';
if (isset($_REQUEST['logout'])) {
$db->beginTransaction();
$logout = $db->prepare('UPDATE bookuuidcustomers SET custID = 0 WHERE uuid = ? AND custID = ?;');
$logout->execute(array(hex2bin($userUUID), $userCustID));
$db->commit();
header('location: index.php');
exit();
} elseif ($userCustID > 0 && isset($_GET['update'])) {
$fieldsSet = (isset($_POST['email'])
&& isset($_POST['fname'])
&& isset($_POST['lname'])
&& isset($_POST['street'])
&& isset($_POST['city'])
&& isset($_POST['state'])
&& isset($_POST['zip']));
if ($fieldsSet) {
$email = validString(filter_var($_POST['email'], FILTER_SANITIZE_EMAIL), 50);
$fname = validString($_POST['fname'], 20);
$lname = validString($_POST['lname'], 20);
$street = validString($_POST['street'], 25);
$city = validString($_POST['city'], 30);
$state = validString($_POST['state'], 2, 1);
preg_match("/^([0-9]{5})$/", $_POST['zip'], $zip);
$zip = validString($zip[0], 5, 4);
$validFields = $email && $fname && $lname && $street && $city && $state && $zip;
if ($validFields) {
$custID = $userCustID;
$user = $db->prepare("SELECT fname, lname, email, street, city, state, zip FROM bookCustomers WHERE custID = ?;");
$user->execute(array($custID));
$userCount = $user->rowCount();
if ($userCount == 1) {
$fields = array(':fname' => $fname, ':lname' => $lname, ':street' => $street, 'city' => $city, 'state' => $state, ':zip' => $zip, ':custID' => $custID);
$update = $db->prepare('UPDATE bookCustomers SET fname = :fname, lname = :lname, street = :street, city = :city, state = :state, zip = :zip WHERE custID = :custID;');
$update->execute($fields);
} else {
error_log("There is not one user with custID ($custID)...");
}
}
header('location: account.php');
exit();
}
$title = 'Update My Account';
$query = $db->prepare('SELECT custID, fname, lname, email, street, city, state, zip FROM bookCustomers WHERE custID = ?;');
$query->execute(array($userCustID));
$fname = '';
$lname = '';
$email = '';
$street = '';
$city = '';
$state = '';
$zip = '';
$custID = '';
$existing = '';
$email = '';
if ($query->rowCount() > 0) {
$result = $query->fetch();
$fname = $result['fname'];
$lname = $result['lname'];
$email = $result['email'];
$street = $result['street'];
$city = $result['city'];
$state = $result['state'];
$zip = $result['zip'];
$existing = "Welcome back $fname! Please update your account information.
";
}
$content .= <<
EOF;
} elseif ($userCustID > 0) {
$title = 'My Account';
$user = $db->prepare('SELECT custID, fname, lname, email, street, city, state, zip FROM bookCustomers WHERE custID = ?;');
$user->execute(array($userCustID));
if ($user->rowCount() != 1) {
header('location: account.php?logout=true');
exit();
}
$result = $user->fetch();
$fname = $result['fname'];
$lname = $result['lname'];
$email = $result['email'];
$street = $result['street'];
$city = $result['city'];
$state = $result['state'];
$zip = $result['zip'];
$content .= "Welcome back!
";
$content .= "
";
} else {
if (isset($_POST['newemail']) && isset($_POST['password']) && isset($_POST['confirm'])) {
$email = filter_var($_POST['newemail'], FILTER_SANITIZE_EMAIL);
$password = validString($_POST['password'], strlen($_POST['password']), 5);
$confirm = validString($_POST['confirm'], strlen($_POST['confirm']), 5);
$existing = $db->prepare('SELECT custID FROM bookCustomers WHERE email like ?;');
$existing->execute(array("%$email%"));
if (strlen($email) > 0 && $password === $confirm && $existing->rowCount() <= 0) {
$db->beginTransaction();
$new = $db->prepare("INSERT INTO bookCustomers (email, salt, fname, lname, street, city, state, zip) VALUES (:email, :salt, '', '', '', '', '', '');");
$salt = openssl_random_pseudo_bytes(8);
$pwHash = hex2bin(hash_hmac('sha512', $email . $password . $salt, $hmacPasswordSecret));
$fields = array(':email' => $email, ':salt' => $salt);
$password = $db->prepare('INSERT INTO bookpwhash (password) VALUES (?);');
$password->execute(array($pwHash));
$new->execute($fields);
$custID = $db->lastInsertId();
$updateUUID = $db->prepare('UPDATE bookuuidcustomers SET custID = ? WHERE uuid = ?;');
$updateUUID->execute(array($custID, hex2bin($userUUID)));
$db->commit();
header('location: account.php');
exit();
} else {
if (!$email) {
$newEmailError .= 'Please enter a valid email address.
';
} elseif ($existing->rowCount() > 0) {
$newEmailError .= 'Please choose a different email address.
';
$newEmail = $email;
} else {
$newEmail = $email;
}
if ($password != $confirm) {
$newPasswordError .= 'Please confirm you typed your password correctly twice.
';
}
}
} elseif (isset($_POST['email']) && isset($_POST['password'])) {
$email = filter_var($_POST['email'], FILTER_SANITIZE_EMAIL);
$password = validString($_POST['password'], strlen($_POST['password']), 5);
if (strlen($email) > 0 && $password) {
$findSalt = $db->prepare('SELECT hex(salt) AS salt, custID FROM bookCustomers WHERE email LIKE ?;');
$findSalt->execute(array("$email"));
$saltArray = $findSalt->fetch();
$salt = hex2bin($saltArray['salt']);
$custID = $saltArray['custID'];
$pwHash = hex2bin(hash_hmac('sha512', $email . $password . $salt, $hmacPasswordSecret));
$userpwd = $db->prepare('SELECT hex(password) FROM bookpwhash WHERE password = ?;');
$userpwd->execute(array($pwHash));
if ($userpwd->rowCount() == 1) {
$db->beginTransaction();
$update = $db->prepare('UPDATE bookuuidcustomers SET custID = :custID WHERE uuid = :uuid;');
$update->execute(array(':custID' => $custID, ':uuid' => hex2bin($userUUID)));
$db->commit();
if ($to == 'orderHistory') {
header('location: orderHistory.php');
} elseif ($to == 'checkout') {
header('location: checkout02.php');
} else {
header('location: account.php');
}
exit();
} else {
$loginEmail = $email;
$loginError = "Username or password not found in database.
";
}
}
}
$redirect = "";
$login = <<
EOF;
$content = $login;
}
require 'template.php';
?>